Yesterday, I restored our entire server from a backup made last week. Before restoring, I backed up everything. We were having instabilities involving email and other systems, so we went back to a time when everything ran smoothly. So far no problems, all looks good. Is there a way to recover the mail that came in during the past week? It's on the pre-restore backup in some form. I'm unwilling to restore the entire priv1.edb and .stm, as I'm afraid it will kill the system again. Where (other than the main data stores) do I look on my backup for any recent mail? Is this even possible? Any part still in queues, logs, or temp files would be helpful. System is SBS 2003 (Exchange 2003, SP2). Many thanks.

What were you using to do your backups? and if you were doing mailbox level backups then you may be able to recover the required data You could use the MS Recovery Storage Groups http://support.microsoft.com/kb/824126, i.e. this way you restore the full EDB STM to the RSG and then export to PST or just recover the delta information. Alternatively if you want to check out a 3rd party product that can open the offline raw EDB/STM set check out Lucid8's DigiScope http://www.lucid8.com/product/digiscope.asp Troy Werelius www.Lucid8.com

Thanks for the reply. Backups were 2-stage, first one was made of the Exchange Store using NTBackup, followed by an image backup of the entire server (3 partitions) using Active@Disk Image all to an external drive. During the nightmare that resulted in restoring the system from the Active@Disk Image (first time I've had to do this - very pleased at how well it worked), I tried restoring just the Exchange Store with NTBackup. This failed on several tries. Upon examination I found: 2/21 (prior to problems) - Priv1.edb = approx 7.2 GB, Priv1.STM = approx 5 GB, total > 12 GB 2/27 - Priv1.edb = approx 7.25 GB, Priv1.STM = 182 MB, total approx 7.5 GB Apparently, NTBackup was not properly backing up, or the damage was already done, hence all our problems. I looked at all the image backups and had to go back to 2/21 to find the full 12 GB data store backup from NTBackup. So we used that to restore from. I still have the nightly image files from each day in between. I'll take a close look at the article you mentioned. It looks pretty complex, and I don't want to disrupt the current working environment.

Happy to assist and Can you present the snapshots/images you took as drive letters without restoring over your existing setup? If yes to # 1 then you should download and get a DEMO license for DigiScope (DS) because that will allow you to copy the EDB and STM off to another area and then open is with DS to see whats available for recovery Troy Werelius www.Lucid8.com

Re your Q1 - I can restore an entire partition or any portion down to file level, and I can restore to an alternate location, so I guess the answer to your question is yes (didn't understand your use of "present"). Thanks for the suggestion and link. I'll try DS to see what can be recovered.

By "present" I meant can you open the snapshot and extract files from it to an alternate location and sounds like you can so thats the way I would go to start and once you get the files exported have DS open them and you will see whats available. If you have any issues with DS call our support and they will be happy to assist.Troy Werelius www.Lucid8.com

Recovery through journaling or RSG.